Differentiated services with multiple tagging levels

Apparatus for network communication, comprising a plurality of nodes mutually coupled to form a network, the nodes including an ingress node, which is adapted to receive a group of flows of data packets for transmission over the network, and to process the flows responsive to an aggregate limit on a total rate of transmission of information by the group of flows and to individual limits on the flows that include a respective individual limit on an individual rate of transmission of the information by each of the flows in the group, such that when the information carried by the packets in any given one of the flows is in excess of the respective individual limit, the network ingress node tags the packets in excess of the respective individual limit in the given one of the flows with a first excess flow tag, and when the total rate of transmission of the information is in excess of the aggregate limit, the network ingress node tags the packets in excess of the aggregate limit with a second excess flow tag, causing the nodes to allocate resources to convey the packets through the network responsive to the first and second excess flow tags.